Importers carry passport liability for data they never created

In substance: that the product carries a working data carrier, that the passport contains what the applicable act requires, that the information is accurate, and that the responsible economic operator details are correct and reachable. "My supplier gave me that data" is an explanation, not a defence.

Through purchase terms and payment sequencing, which are the only instruments an importer reliably controls.

• Make passport completeness a condition of acceptance, not a post-shipment cleanup task.
• Warrant the data, with an indemnity for costs arising from inaccuracy — including recall and market-withdrawal costs.
• Require the field annex in a named format at purchase-order level, so each shipment carries its own evidence.
• Where volumes justify it, appoint an authorised representative arrangement and document the split of responsibilities.

Short and repeatable: scan a sample unit, confirm the carrier resolves, confirm the identifier matches the physical marking, spot-check two or three high-risk fields against the technical documentation, and record the result against the shipment. Ten minutes per shipment, kept as evidence of due diligence, is the difference between an inconsistency you found and one an authority found.

Decide the answer before it happens, in writing, and have somebody senior own it. Options are narrow — hold, remediate the data before release, or accept the risk with a recorded rationale. The failure mode is not choosing the wrong option; it is having no documented decision at all when the question arrives.